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WHAT IS CLAIMED IS: 
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method for real-time measurement of the 
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2 performance of communications on a large area network between 

3 a selected eerver and a plurality of users, based upon actual 

4 user experigpce, including: 

5 (a) accessing a server log having records of actual user 

6 access fto the selected server; 

7 (b) aggregating records from the server log into a plurality 

8 of aggregate slots, each having at least one time bin, 

9 based on ah aggregation method; 

(c) performing fet least one statistical analysis of each 
time bin of each aggregate slot; and 

(d) outputting tne results of such statistical analysis as 
an indication\of actual server usage by users, 

2. The method \of claim 1, further including filtering 
out selected records ^rom the server log before the step of 
aggregating. 



1 3. The method of blaim 1, further including generating 

2 an event notification if \a selected statistical analysis value 

3 is abnormal. 

1 4. The method of cl^_m 1, further including selecting 

2 the aggregation method f rom \ set of aggregation methods. 
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5. \ The method of claim 1, wherein the aggregation 
method includes aggregation by log-file record column data 
value for Ifach record from the server log, 

6. The method of claim 1, further including: 

(e) determining geographical or source information for each 
record* and 

(f) selecting the aggregation method to aggregate records 
based ora such geographical or source information, 

7. The method of claim 6, wherein determining 
geographical or source information for each record includes: 

(g) defining a \database comprising large area network 
address blocks having geographical or source 

inf ormation;! 

(h) comparing an \address field in each record to the address 
blocks in the \database; and 

(i) associating with each record the geographical or source 
information from an address block matching the address 
field of the record. 

8. The method of \claim 1, wherein comparing an address 
field in each record t\> the address blocks in the database 
includes : 
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(j) defining an array of binary trees for the address blocks 

inlthe database, each address block within a binary tree 

within an array element being masked by a corresponding 

unique subnet mask value; 
(k) masking each address field in each record by a unique 

subnat value corresponding to a selected array element; 
(1) comparing each masked address field to an address field 

of the\ address blocks within the binary tree of the 

selected array element; 
(m) outputtlng selected fields of any matching address 

block; arid 

(n) otherwise^ continuing the step of comparing with a next 
selected array element until a match is found or all 
array elements have been compared. 
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9. The methpd of claim 1, further including: 
(o) determining exit routing paths from each selected server 

based on the records from the server log; 
(p) determining a nest performing exit route based on the 

statistical analysis of records from the server log; 
(q) biasing incoming\and outgoing communications with 

respect to each server to use the determined best 

performing exit route. 
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1 1 0 . \ A method for comparing an address field of a large 
area network record to a database comprising large area 
network \ddress blocks having geographical or source 
informatioV including: 

(r) defining\an array of binary trees for the address blocks 
in the database, each address block within a binary tree 
within an array element being masked by a corresponding 
unique subnen mask value; 
(s) masking the address field of a large area network record 
by a unique sublet value corresponding to a selected 
array element; 

(t) comparing each masked address field to an address field 
of the address blocks within the binary tree of the 
selected array element 
(u) indicating a match; and\ 

(v) otherwise, continuing th& step of comparing with a next 
selected array element untYl a match is found or all 
array elements have been compared. 
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11. \ A system for real-time measurement of the 
performance of communications on a large area network 
betweema selected server and a plurality of users, based 
upon actual user experience, including: 

(w) a servfer log having records of actual user access to the 
selectep server; 



-23- 



) means for accessing and aggregating records from the 
server log into a plurality of aggregate slots, each 
having at least one time bin, based on an aggregation 
meT hod; 

(y) means for performing at least one statistical analysis 
of each time bin of each aggregate slot; and 

(z) means for outputting . the results of such statistical 
analysis as an indication of actual server usage by 
usels. 

12. The. system of claim 11, further including means for 
filtering dut selected records from the server log before the 
step of aggregating. 

13. Trie system of claim 11, further including means for 
generating anievent notification if a selected statistical 
analysis value\is abnormal. 

14. The sVstem of claim 11, further including means for 
selecting the aggregation method from a set of aggregation 
methods . \ 

15. The system of claim 11, wherein the aggregation 
method includes aggregation by log-file record column data 
value for each recorA from the server log. 

16. The system ofi claim 11, further including: 
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(aa) \means for determining geographical or source 

information for each record; and 
(bb) means for selecting the aggregation method to 

aggrecrate records based on such geographical or source 
information. 
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17. The system of claim 16, wherein the means for 
determining geographical or source information for each record 
includes : 

(cc) a database comprising large area network address 

blocks having geographical or source information; 

(dd) a comparison function for comparing an address field 
* \ 

in each recorq} to the address blocks in the database; 
and 

(ee) an associating function for associating with each 
record the geographical or source information from an 
address block matching the address field of the record. 

18. The system o^ claim 17, wherein the comparison 
function includes : 

(ff) an array of binary trees for the address blocks in 
the database, each address block within a binary tree 
within an array element being masked by a corresponding 
unique subnet mask valiue; 
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(gg) frieans for masking each address field in each record 




by a lunique subnet value corresponding to a selected 
array! element; 

(hh) means for comparing each masked address field to an 
address^ field of the address blocks within the binary 
tree of \the selected array element; 
(ii) meani for outputting selected fields of any matching 

address block; and 
(jj) means for otherwise continuing the step of comparing 
with a next\ selected array element until a match is 
found or all\ array elements have been compared. 

19. The system of claim 11, further including: 
(kk) means for Determining exit routing paths from each 
selected server\ based on the records from the server 
log; 

(11) means for determining a best performing exit route 
based on the statistical analysis of records from the 
server log; 

(mm) means for biasing incoming and outgoing 

communications with respect to each server to use the 
determined best performing exit route. 

0. \ A system for comparing an address field of a large 
area Aetwork record to a database comprising large area 
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network address blocks having geographical or source 
information, including: 
(nn) arvyarray of binary trees for the address blocks in 

the database, each address block within a binary tree 

within an Wray element being masked by a corresponding 

unique subnet mask value; 
(oo) means foAmasking the address field of a large area 

network record\by a unique subnet value corresponding to 

a selected array element; 
(pp) means for comparing each masked address field to an 

address field of uhe address blocks within the binary 

tree of the selected array element; 
(qq) means for indicating a match; and 

(rr) means for otherwise continuing the step of comparing 
with a next selected array element until a match is 
found or all array elements have been compared. 
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computer program, stored on a computer-readable 
mediumX for real-time measurement of the performance of 
communications on a large area network between a selected 
server and a plurality of users, based upon actual user 
experience, the computer program comprising instructions 
for causing a computer system to: 
(ss) accessla server log having records of actual user 
access to tpe selected server; 
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9 (tx) aggregate records from the server log into a 

10 plurality of aggregate slots, each having at least one 

11 time aln, based on an aggregation method; 

12 (uu) perform at least one statistical analysis of each 

13 time biit of each aggregate slot; and 

14 (vv) output the results of such statistical analysis as 

15 an indication of actual server usage by users. 

1 22. The obmputer program of claim 21, further including 

2 instructions forlcausing the computer system to filter out 

3 selected records from the server log before the step of 
iQ 4 aggregating. \ 

| r i 1 23. The computer program of claim 21, further including 

:fk \ 

ifl 2 instructions for causing the computer system to generate an 

5 ," 3 event notification in a selected statistical analysis value is 

jt| 4 abnormal . \ 

itl \ 
W \ 

sp 1 24. The computen program of claim 21, further including 

*y \ 

2 instructions for causind the computer system to select the 

3 aggregation method from a set of aggregation methods. 

1 25. The computer prouram of claim 21, wherein the 

2 aggregation method incluaes aggregation by log-file record 

3 column data value for eacra record from the server log. 

1 26. The computer program of claim 21, further including 

2 instructions for causing tfte computer system to: 
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(ww) determine geographical or source information for 

each [record; and 

|xx) select the aggregation method to aggregate records 

based Ion such geographical or source information. 
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27. Tme computer program of claim 26, wherein the 
instructions \for causing the computer system to determine 
geographical or source information for each record further 
include instructions for causing the computer system to: 

(yy) define a database comprising large area network 
address blocks having geographical or source 
inf ormatic 

(zz) compard an address field in each record to the 

address blocks in the database; and 
(aaa) associate with each record the geographical or 

source information from an address block matching the 

address field pf the record. 

28. The computer program of claim 27, wherein the 
instructions for causing the computer system to compare 
an address field in\each record to the address blocks in 
the database include \instructions for causing the 
computer system to: 

(bbb) define an array of\binary trees for the address 
blocks in the database, \each address block within a 
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binary tree within an array element being masked by a 
corresponding unique subnet mask value; 
(ccc) I mask each address field in each record by a unique 
sulinet value corresponding to a selected array element; 
(ddd) I compare each masked address field to an address 
fieild of the address blocks within the binary tree of 
thel selected array element; 
(eee) \output selected fields of any matching address 
block; and 

- (fff ) otherwise, continue the step of comparing with a 
next selected array element until a match is found or 
all ariay elements have been compared. 

29. The computer program of claim 21, further including 
instructions f©r causing the computer system to: 

(ggg) deteAnine exit routing paths from each selected 

server baaed on the records from the server log; 
(hhh) determine a best performing exit route based on the 

statistical^ analysis of records from the server log; 
(iii) bias incoming and outgoing communications with 
respect to each server to use the determined best 
performing exit route. 

7\ \ 

0. \ A computer program, stored on a computer-readable 
medium, for comparing an address field of a large area 
network record to a database comprising large area 
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network address blocks having geographical or source 
information, the computer program comprising instructions 
for causing a computer system to: 
(jjj) deririe an array of binary trees for the address 
blocks in\the database, each address block within a 
binary tree within an array element being masked by a 
corresponding unique subnet mask value; 
(kkk) mask the address field of a large area network 
record by a unVque subnet value corresponding to a 
selected array etlement; 
(111) compare each Viasked address field to an address 
field of the address blocks within the binary tree of 
the selected array element; 
(mmm) . indicate a match; Vnd 

(nnn) otherwise, continueXthe step of comparing with a 
next selected array element until a match is found or 
all array elements have been compared. 
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